I think that's incorrect.

They couldn't log in, because that VPN tunnel is only open before logging in. So they had to gain access while on the login screen.